USN-942-1: PostgreSQL vulnerabilities

Releases

• Ubuntu 10.04
• Ubuntu 9.10
• Ubuntu 9.04
• Ubuntu 8.04
• Ubuntu 6.06

Packages

• postgresql-8.1 - object-relational SQL database, version 8.1 server
• postgresql-8.3 - object-relational SQL database, version 8.3 server
• postgresql-8.4 - object-relational SQL database, version 8.4 server

Details

It was discovered that the Safe.pm module as used by PostgreSQL did not
properly restrict PL/perl procedures. If PostgreSQL was configured to use
Perl stored procedures, a remote authenticated attacker could exploit this
to execute arbitrary Perl code. (CVE-2010-1169)

It was discovered that PostgreSQL did not properly check permissions to
restrict PL/Tcl procedures. If PostgreSQL was configured to use Tcl stored
procedures, a remote authenticated attacker could exploit this to execute
arbitrary Tcl code. (CVE-2010-1170)

It was discovered that PostgreSQL did not properly check privileges during
certain RESET ALL operations. A remote authenticated attacker could exploit
this to remove all special parameter settings for a user or database.
(CVE-2010-1975)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 9.10

• postgresql-pltcl-8.4 - 8.4.4-0ubuntu9.10
• postgresql-plperl-8.4 - 8.4.4-0ubuntu9.10

Ubuntu 9.04

• postgresql-plperl-8.3 - 8.3.11-0ubuntu9.04
• postgresql-pltcl-8.3 - 8.3.11-0ubuntu9.04

Ubuntu 8.04

• postgresql-plperl-8.3 - 8.3.11-0ubuntu8.04
• postgresql-pltcl-8.3 - 8.3.11-0ubuntu8.04

Ubuntu 6.06

• postgresql-plperl-8.1 - 8.1.21-0ubuntu0.6.06
• postgresql-pltcl-8.1 - 8.1.21-0ubuntu0.6.06

Ubuntu 10.04

• postgresql-pltcl-8.4 - 8.4.4-0ubuntu10.04
• postgresql-plperl-8.4 - 8.4.4-0ubuntu10.04

This update uses a new upstream release, which includes additional bug
fixes. In general, a standard system update will make all the necessary
changes.

References

• CVE-2010-1169
• CVE-2010-1170
• CVE-2010-1975